Privacy Policy

This Privacy Policy explains how Struxsion Ltd (“Struxsion”, “we”, “us”, “our”) collects, uses, discloses, and protects personal data when acting as a Data Controller. This Policy applies to our websites, applications, and services, including the Struxsion CRM platform.

‍

1. Who We Are

Struxsion Ltd is a company incorporated in England and Wales. We provide a software-as-a-service (SaaS) customer relationship management (CRM) platform primarily for business users. For customer-uploaded data within the CRM, Struxsion generally acts as a Data Processor on behalf of its customers. This Privacy Policy covers personal data for which Struxsion acts as a Data Controller.

‍

2. Scope of This Privacy Policy

This Privacy Policy applies where we determine the purposes and means of processing personal data, including data relating to: (a) visitors to our websites; (b) users of our Services; (c) prospective customers; (d) billing and payment contacts; (e) support communications; and (f) security, audit, and compliance records.

‍

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity and contact data: name, business name, job title, email address, telephone number, postal address.

• Account data: login credentials (hashed), user roles, account preferences.

• Billing and transaction data: billing contact details, invoices, payment status (payment card details are processed by Stripe and not stored by us).

• Usage and technical data: IP address, device type, browser, log files, timestamps, feature usage.

• Communications data: emails, support tickets, chat messages, feedback.

• Marketing data: preferences relating to marketing communications.

• Compliance and security data: audit logs, access records, incident reports.

‍

4. Data We Do Not Intentionally Collect

We do not intentionally collect special category personal data (such as health, biometric, or religious information) or criminal offence data in our capacity as Data Controller. Any such data submitted by customers into the CRM is processed by Struxsion solely as a Data Processor and is governed by the Data Processing Addendum.

‍

5. How We Use Personal Data

We use personal data for the following purposes:

• To provide, operate, and maintain the Services.

• To create and manage user accounts.

• To process payments and manage subscriptions.

• To provide customer support and respond to enquiries.

• To monitor usage, performance, and security of the Services.

• To improve and develop our products and features.

• To send service-related communications.

• To send marketing communications where permitted.

• To comply with legal obligations and enforce our terms.

‍

6. Lawful Bases for Processing

We process personal data under the following lawful bases, as applicable:

• Contract: where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

• Legal obligation: where required to comply with legal or regulatory obligations.

• Legitimate interests: where necessary for our legitimate business interests, provided those interests are not overridden by your rights.

• Consent: where required by law, such as for certain marketing communications or non-essential cookies.

‍

7. Marketing Communications

We may send marketing communications to business contacts where permitted by law. You may opt out of marketing at any time by using the unsubscribe link in emails or by contacting us directly. Service-related communications are not subject to opt-out.

‍

8. Cookies and Similar Technologies

We use cookies and similar technologies on our websites. Further information is provided in our Cookie Policy, including details of cookie types, purposes, and how to manage preferences.

‍

9. Sharing and Disclosure of Personal Data

We may share personal data with:

• Service providers and subprocessors who support our business operations.

• Payment processors (such as Stripe).

• IT, hosting, analytics, and email delivery providers.

• Professional advisers (lawyers, accountants, auditors).

• Regulators, courts, or authorities where required by law.

• A buyer or successor in connection with a merger, acquisition, or asset sale.

‍

10. Subprocessors

We use carefully selected subprocessors to support delivery of the Services. Key subprocessors may include Supabase (database and hosting services), Resend (email delivery), Stripe (payment processing), and OpenAI (AI-assisted features). An up-to-date list of subprocessors is made available to customers.

‍

11. International Data Transfers

Personal data may be transferred outside the United Kingdom or European Economic Area. Where this occurs, we implement appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, to ensure an adequate level of protection.

‍

12. Data Security

We implement appropriate technical and organisational measures designed to protect personal data, including access controls, encryption, logging, and incident response procedures. No system is completely secure, and we cannot guarantee absolute security.

‍

13. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary depending on the nature of the data and legal requirements.

‍

14. Your Data Protection Rights

Depending on your location, you may have the right to request access to, rectification or erasure of your personal data, to restrict or object to processing, and to data portability. You may also withdraw consent at any time where processing is based on consent.

‍

15. Exercising Your Rights

Requests to exercise data protection rights should be submitted by contacting us using the details below. We may require verification of identity before responding.

‍

16. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the UK or with another applicable supervisory authority.

‍

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will provide reasonable notice. Continued use of the Services after changes take effect constitutes acceptance.

‍

18. Contact Us

For privacy-related enquiries or requests, please contact: privacypolicy@struxsion.co.uk

‍